I'm not a security expert either, but I doubt most companies have anything like that running. Many leaks happened through the site itself, which is expected to be able to access and present that data, and even if the attacker transfers an actual file, it's fairly easy to encrypt it beforehand.
There is some software that can detect an anomaly in the regular pattern of network usage, and possibly even cut the connection, but again, I'm not sure how effective they would be here.
In any case, considering they were using unsalted SHA-1 hashes of the passwords, which was well known to be a poor practice, you should probably assume they had very little protections.